package com.example.vulnerableapplication.Activity;

import androidx.appcompat.app.AppCompatActivity;

import android.annotation.SuppressLint;
import android.content.BroadcastReceiver;
import android.content.ComponentName;
import android.content.Context;
import android.content.Intent;
import android.content.IntentFilter;
import android.content.pm.PackageManager;
import android.content.pm.ResolveInfo;
import android.net.Uri;
import android.os.Bundle;
import android.provider.MediaStore;
import android.util.Log;
import android.view.View;
import android.widget.Button;

import com.example.vulnerableapplication.R;
import com.example.vulnerableapplication.provider.grantUriPermissionsActivity;

import java.io.File;
import java.net.URISyntaxException;
import java.util.List;

import static androidx.core.content.FileProvider.getUriForFile;

public class MainActivity extends AppCompatActivity {

    final String action = "com.zzw";
    BroadcastReceiver mBroadcastReceiver;
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);
        Button btn_sendBroadcast = findViewById(R.id.sendBroadcast);
        initBroadcast();
        btn_sendBroadcast.setOnClickListener(new View.OnClickListener() {
            @SuppressLint("WrongConstant")
            @Override
            public void onClick(View v) {
                Log.e("Rzx","发送静态广播");
                Intent intent = new Intent("com.victim.messenger.IN_APP_MESSAGE");
                intent.addFlags(0x01000000 | 0x00400000);
//                Intent intent = new Intent();
//                ComponentName componentName=new ComponentName(getApplicationContext(),"com.example.vulnerableapplication.BroadcastReceiver.MyBroadcastReceiver");
//                intent.setComponent(componentName);
//                intent.putExtra("from", "123456");
//                intent.putExtra("text", "text");
//                Log.i("ActivityTaskManager",intent.toUri(Intent.URI_INTENT_SCHEME));
                // intent:#Intent;component=com.example.vulnerableapplication/.BroadcastReceiver.MyBroadcastReceiver;S.from=123456;S.text=text;end



//                Intent intent = null;
//                try {
//                    intent = Intent.parseUri("intent:#Intent;component=com.example.vulnerableapplication/.BroadcastReceiver.MyBroadcastReceiver;S.from=123456;S.text=text;end",Intent.URI_INTENT_SCHEME);
//                } catch (URISyntaxException e) {
//                    e.printStackTrace();
//                }


                sendBroadcast(intent);
            }
        });
        Button btn_sendBroadcast2 = findViewById(R.id.sendBroadcast2);
        btn_sendBroadcast2.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
//                Intent intent = new Intent();
//                intent.setAction(action);
//                intent.putExtra("name", "zzw");
//                Log.i("ActivityTaskManager",intent.toUri(Intent.URI_INTENT_SCHEME));
                // intent:#Intent;action=com.zzw;S.name=zzw;end

                Intent intent = null;
                try {
                    intent = Intent.parseUri("intent:#Intent;action=com.zzw;S.name=zzw;end",Intent.URI_INTENT_SCHEME);
                } catch (URISyntaxException e) {
                    e.printStackTrace();
                }
                MainActivity.this.sendBroadcast(intent);
                Log.e("发送广播的状态-----","发送成功");
            }
        });


        Button btn_grantUriPermissions1 = findViewById(R.id.grantUriPermissions1);
        btn_grantUriPermissions1.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                Intent intent = new Intent(MainActivity.this, grantUriPermissionsActivity.class);
                startActivity(intent);
            }
        });
        Button btn_action = findViewById(R.id.action_actiivity);
        btn_action.setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                //隐式启动activity
                Intent intent = new Intent("com.exploit.yinshi");
                startActivity(intent);
            }
        });
        Button btn_fileprovider11 = findViewById(R.id.fileprovider11);
        btn_fileprovider11.setOnClickListener(new View.OnClickListener() {
            //主动调用exploitApplication 的MainActivity防范，在MainActivity类中单独写了接受Intent的方法
            @Override
            public void onClick(View v) {
                File testFile =new File(MainActivity.this.getBaseContext().getCacheDir(),"test.html");
                Uri uriForFile = getUriForFile(getApplicationContext(), "com.example.vulnerableapplication.fileProvider", testFile);

                Intent intent = new Intent();
                intent.setClassName("com.example.exploitapplication","com.example.exploitapplication.MainActivity");

//        Intent intent = new Intent(MediaStore.ACTION_IMAGE_CAPTURE);
                List<ResolveInfo> resInfoList = getPackageManager().queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY);
                for (ResolveInfo resolveInfo : resInfoList) {
                    String packageName = resolveInfo.activityInfo.packageName;
                    grantUriPermission(packageName, uriForFile, Intent.FLAG_GRANT_WRITE_URI_PERMISSION | Intent.FLAG_GRANT_READ_URI_PERMISSION);
                }
                intent.putExtra(MediaStore.EXTRA_OUTPUT, uriForFile);
                intent.addFlags(Intent.FLAG_GRANT_WRITE_URI_PERMISSION | Intent.FLAG_GRANT_READ_URI_PERMISSION);
                startActivityForResult(intent, 200);

            }
        });


    }


    // 注册接收端
    private void initBroadcast() {
        mBroadcastReceiver = new TestBroadcastReceiver();
        IntentFilter filter = new IntentFilter(action);// 过滤
        registerReceiver(mBroadcastReceiver, filter);
    }

    private class TestBroadcastReceiver extends BroadcastReceiver {
        // 接收广播

        @Override
        public void onReceive(Context context, Intent intent) {
            Log.e("接受广播的状态-----", "动态广播接受成功");
            Log.e("收到的action-----", intent.getAction());
            Log.e("收到的name-------", intent.getExtras().getString("name"));
        }
    }

    // 关闭广播
    @Override
    protected void onDestroy() {
        if (mBroadcastReceiver != null) {
            unregisterReceiver(mBroadcastReceiver);
        }
        super.onDestroy();
    }



}